PHP2Shell Explained: Wiz CTO Warns of Coming Vulnpocalypse After Critical PHP Bugs

TL;DR

• Critical PHP flaws dubbed PHP2Shell expose an estimated 70% of websites to remote code execution, triggering emergency patches and temporary site shutdowns worldwide.
• Wiz researchers uncovered the bugs in core PHP extensions and libraries, with exploitation already observed in the wild and cleanup expected to take months.
• Wiz CTO warns the incident signals a coming vulnpocalypse for open-source infrastructure as attackers weaponize foundational code at scale.

A Quiet Core Flaw With Internet-Wide Blast Radius

PHP still powers the backbone of the web, from WordPress and Drupal to Magento, Laravel, and countless custom stacks. That ubiquity is exactly why the newly disclosed PHP2Shell vulnerabilities are so dangerous.

According to researchers at cloud security firm Wiz, two critical chainable flaws in widely used PHP components allow unauthenticated attackers to go from a simple web request to full remote code execution — essentially turning any vulnerable website into a shell in one or two steps. Early estimates suggest roughly 70 percent of PHP-based sites were exposed at the time of disclosure.

The bugs affect default configurations and popular shared-hosting setups, meaning small businesses were just as at risk as large enterprises. Cloud providers and hosting giants were forced to push emergency patches over the weekend, while some organizations took sites offline entirely to stop active probing.

How Wiz Researchers Found PHP2Shell

Wiz's research team said they stumbled on the issues while auditing memory handling and file-upload logic in PHP's ecosystem — areas that haven't received deep scrutiny in years despite their massive deployment.

One vulnerability involves unsafe deserialization and filter bypass that lets attackers smuggle malicious payloads through image uploads, form inputs, or API parameters. The second allows privilege escalation from that foothold to system-level shell execution, bypassing common hardening like disable_functions and open_basedir.

In a technical breakdown, Wiz demonstrated a full exploit chain in under 30 seconds against an unpatched server, with no login required. The firm privately reported the flaws to PHP maintainers and major downstream vendors weeks ago, coordinating a synchronized patch release before going public.

Emergency Patching And Painful Shutdowns

The response was immediate and chaotic. PHP released emergency security updates, and downstream projects including WordPress, cPanel, Plesk, and major Linux distributions rushed out their own fixes.

Managed hosting providers including Cloudflare, AWS, and Akamai deployed virtual patches and WAF rules to block exploit attempts, reporting a massive spike in scanning activity within hours of disclosure. Wiz said it observed opportunistic exploitation and botnet-style mass scanning almost immediately after technical details leaked.

For many teams, patching wasn't as simple as clicking update. Older PHP 7.x and early 8.x branches, still widely used despite being end-of-life, required manual mitigation or upgrades. Some agencies and e-commerce operators chose to shut down public-facing portals, admin panels, and legacy subdomains until they could verify they were clean.

Why Cleanup Is Far From Over

Patching PHP itself is only step one. Security leaders warn the real problem is the long tail of vulnerable deployments.

Millions of sites run on shared hosts, abandoned plugins, Docker images, and forgotten marketing microsites where no one is actively applying updates. Even fully patched servers may already be compromised, as attackers have been dropping web shells, crypto miners, and persistent backdoors.

Wiz CTO stresses that organizations must assume breach: hunt for indicators of compromise, rotate secrets and API keys, rebuild containers from clean images, and audit file upload directories. Federal agencies in the U.S. have added PHP2Shell to the Known Exploited Vulnerabilities catalog with a tight remediation deadline.

The Coming Vulnpocalypse For Open Source

In interviews this week, Wiz's CTO framed PHP2Shell as a preview of a broader vulnpocalypse — a wave of critical flaws in foundational open-source building blocks like Curl, OpenSSL, Log4j, and now PHP.

The argument is stark: the internet still depends on decades-old, underfunded code maintained by tiny teams, while AI-assisted vulnerability hunting is now allowing both researchers and attackers to find bugs faster than ever. Defenders, meanwhile, are stuck with sprawling, invisible supply chains.

The call to action includes more funding for open-source maintainers, universal software bill of materials adoption, faster auto-update mechanisms for hosting providers, and a shift to memory-safe practices where possible.

What To Do Now

Security experts recommend immediate action: upgrade to the latest patched PHP versions, update CMS cores, themes and plugins, enable WAF blocking for PHP2Shell exploit patterns, disable or restrict file uploads where possible, and scan for unknown PHP shells.

For teams that can't patch immediately, Wiz and other vendors have released detection scripts, YARA rules, and hardening guides. But the message from researchers is clear — this isn't a patch-and-forget bug. PHP2Shell will be exploited for months, if not years, and the next foundational flaw is already around the corner.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.